How Long Should Your Business Keep Documents? A Practical Retention Guide for Malaysian Companies
One of the most common compliance questions we hear from clients is deceptively simple: how long do we actually need to keep this? Keeping documents too long is a PDPA liability. Destroying them too soon is a legal and commercial risk. Getting the balance right requires a documented retention schedule — and knowing which laws set the minimum periods for your document types.
Why retention periods matter on both ends
There are two distinct risks in document retention, and organisations typically only worry about one of them.
The more obvious risk is destroying documents too soon. If you are the subject of a tax audit, a legal dispute, or a regulatory investigation, and you cannot produce the documents that should have been retained, the consequences range from adverse findings to criminal liability. Courts and regulators treat missing records with significant suspicion.
The less understood risk is retaining documents too long. Under the PDPA's Retention Principle, personal data must not be kept beyond the period necessary for the purpose it was collected. Every day a document containing personal data sits in your filing system beyond its required retention period, you are in technical breach of the Act. More practically, it means your data exposure in the event of a breach is larger than it needs to be.
A documented retention schedule that specifies both the minimum and maximum retention period for each document type — and what happens at the end of that period — is the foundation of good information governance and the starting point for any PDPA compliance programme.
General retention periods for Malaysian businesses
The following periods reflect the requirements of Malaysian law for the most common business document categories. Always verify against your sector's specific regulatory requirements, which may impose longer minimums.
- Financial and accounting records — Minimum 7 years under the Companies Act 2016 and Income Tax Act 1967. This includes general ledgers, journals, invoices, receipts, and supporting documentation.
- Tax records and supporting documents — Minimum 7 years from the relevant year of assessment under the Income Tax Act 1967. The Inland Revenue Board (LHDN) may request records going back this far in an audit.
- Employment records (active employees) — For the duration of employment, with key records (contracts, performance reviews, pay records) retained throughout.
- Employment records (after departure) — Minimum 6 years after the date of termination or resignation. EPF, SOCSO, and income tax obligations require access to historical payroll data during this period.
- Contracts and commercial agreements — 6 years from the date of expiry or termination, reflecting the standard limitation period under the Limitation Act 1953 during which contract claims may be brought.
- Client and customer files — Varies significantly by industry. As a general rule, 7 years from the date of the last transaction or engagement is a widely applied minimum in professional services.
- Medical records — Minimum 7 years from the date of last treatment for adults; for minors, records must be retained until the patient reaches age 25, or for 7 years after the last treatment, whichever is longer.
- Company statutory records — Minimum 7 years under the Companies Act 2016. This includes minutes of meetings, resolutions, and sha
Ready to protect your organisation?Get a Free Quote →
Get a free consultation from Grass Stories Sdn Bhd — Sarawak’s trusted document destruction specialist.